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AMENDMENTS TO THE CLAIMS 

What Is Claimed Is: 
1-41. Cancelled 

42. (Currently Amended) A computer-based method for identifying a situation representing 
risk to a brokerage or its investors, comprising: 

receiving, on a periodic basis, data from at least one source, wherein the received data 
comprises a plurality of transactions relating to securities trading and a plurality of entities 
involved in securities trading, wherein the plurality of transactions and the plurality of entities 
are not predetermined to be related; 

accessing a scenario library to identify a detection algorithm for identifying a behavior of 
interest indicative of a risk to a brokerage or its investors; 

applying the detection algorithm to identify common elements between a one or more of 
the plurality of the transactions and a one or more of the plurality of the entities in the received 
data to determine whether the common elements are collectively indicative of the behavior of 
interest; 

determining, by a computing device, whether one or more relationships exist among the 
transactions and the entities that exhibit the common element; and 

if-sor in response to one or more relationships existing among the transactions and the 
entities that exhibit the common element, generating an alert informing a user of the related 
transactions and entities that exhibit the common elements. 
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43. (Previously Presented) The method of claim 42, wherein the determining whether 
one or more relationships exist comprises performing one or more of the following on the 
plurality of transactions and the plurality of entities: 

sequence matching to identify sequences in one or more transactions and to relate the 
identified sequences to one or more of the entities in the received data; 

link analysis to establish connections between one or more transactions and entities in the 
received data; 

rule-based analysis to identify at least one of the transactions and entities based on rules 
specifying parameters and thresholds; 

outlier detection analysis to identify at least one of the transactions and entities outside of 
a defined statistical range; 

decision tree analysis; and 

detection processing using neural networks. 

44. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises holding concentrated positions in a single security; and 
the received data comprises market value of a concentrated position and total cash and 
security value. 
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45. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises holding a concentrated position in low-priced 
securities; and 

the received data comprises low-priced equities balance and total cash and security value. 

46. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises abusing auto-execution systems; and 

the received data comprises information associated with a plurality of orders. 

47. (Withdrawn) The method of claim 46, further comprising generating an alert if one or 
more of the following conditions are met: 

each order is on a same side of a market; 

a total time span between orders is less than a threshold; 

a quantity of each order is less than an auto-execution threshold; 

a total quantity of orders exceeds the auto-execution threshold; 

a plurality of the orders originate from a same account; 

a plurality of the orders originate from a plurality of accounts associated with a same 
household; and 

the orders are entered during regular trading hours. 
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48. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises marking the close; and 

the received data comprises order time, holdings by others in a household and margin 
maintenance percentage. 

49. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises making improper short sales; and 
the received data comprises securities sold by an account holder, securities held long by 
an account holder and securities purchased by an account holder. 

50. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises making cross-trades away from the market; and 
the received data comprises information associated with a plurality of executions. 

5 1 . (Withdrawn) The method of claim 50, further comprising generating an alert if a 
plurality of executions: 
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occur during extended trading hours; 
involve a same security; 
have a same execution price; 
have a same execution date and time; 
are on opposite sides of a market. 

52. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises encouraging orders by marking them as unsolicited; 

and 

the received data comprises a number of unsolicited orders and a number of solicited 

orders. 

53. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage; 

the behavior of interest comprises encouraging short-term holding; and 

the received data comprises buy orders, sell orders and indication of solicitation. 

54. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more securities 
representatives; 
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the behavior of interest comprises soliciting orders but marking them as unsolicited; and 
the received data comprises solicitation attempts and unsolicited orders. 

55. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more securities 
representatives; 

the behavior of interest comprises shadowing a customer's account; and 
the received data comprises time between trades in a security. 

56. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more brokerage order-takers or 
employees; 

the behavior of interest comprises front-running; and 

the received data comprises employee account activity and employee-linked account 
activity. 

57. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more brokerage employees; 
the behavior of interest comprises trading on insider information; and 
the received data comprises closing prices and trades in an account associated with an 
employee. 
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58. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more brokerage employees; 
the behavior of interest comprises making large deposits; and 

the received data comprises employee deposit amounts and employee account net worth. 

59. (Currently Amended) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more customers of a securities 
brokerage and securities representatives; 

the behavior of interest comprises rapid switching of one mutual fund[[s]] for another 
mutual fund ; and 

the received data comprises fund purchase date, mutual fund sale date and solicitation 
records. 

60. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve one or more investment advisors; 
the behavior of interest comprises disproportionate allocation of IPO shares; and 
the received data comprises IPO initial trading price, IPO closing price and subaccount 
IPO allocation. 

61 . (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve an investment advisors; 
the behavior of interest comprises unfair allocation of block trades to subaccounts of the 
investment advisor; and 

-8- 



Attorney Docket No. 124256.00401 

the received data comprises block trade purchase price, block trade allocation and 
security price at time of allocation. 

62. (Withdrawn) The method of claim 42, wherein 

one or more of the plurality of transactions involve an investment advisor; 

the behavior of interest comprises maintenance of concentrated positions in a subaccount 
of the investment advisor; and 

the received data comprises a value of individual equities within the subaccount, a value 
of the subaccount and a total number of subaccounts managed by the advisor. 

63. (Previously Presented) The method of claim 42, further comprising: 
prioritizing the one or more relationships, wherein the prioritizing is based on user 

defined logic and values; and 

generating one or more alerts based on one or more of the prioritized relationships. 

64. (Previously Presented) The method of claim 42, wherein 
determining whether one or more relationships exist comprises prioritizing the 

determined relationships; and 

generating an alert comprises generation an alert only if a relationship having a 
predetermined priority is identified. 
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65. (Previously Presented) The method of claim 42, further comprising: 
identifying any accounts associated with the determined transactions and entities that 

meet a set of user-defined criteria; 

generating an alert informing the user of the identified accounts. 

66. (Previously Presented) The method of claim 42, further comprising: 
identifying one or more accounts that meet a set of user-defined criteria for a current 

month but that did not meet the set of user-defined criteria for a previous month, wherein the 
accounts are associated with the determined transactions and entities; 
generating an alert comprising the identified accounts. 

67. (Previously Presented) The method of claim 42, further comprising: 
identifying a household, having a plurality of associated accounts, 
wherein the household meets a set of user-defined criteria, 

wherein the household is associated with one or more of the determined transactions and 
entities; 

wherein none of the associated accounts individually meet the set of user-defined criteria; 

and 

generating an alert comprising the identified household. 

68. (Previously Presented) The method of claim 42, further comprising: 
identifying a first set of households, wherein each household is associated with one or 

more accounts, wherein each household meets a set of user-defined criteria, wherein none of the 
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accounts associated with the household individually meet the set of user-defined criteria, wherein 
each household in the first set is associated with one or more of the determined transactions and 
entities; and 

identifying from the first set of households, a second set of households comprising 
households that did not meet the set of user-defined criteria in a previous month. 

69. (Previously Presented) The method of claim 42, wherein generating an alert 
comprises: 

providing one or more alert visualizations associated with the transactions and the entities 
that exhibit the common elements to a user. 

70. (Currently Amended) The method of claim 42, further comprising: 
assigning a score to the determined relationships; 

determining an alert value associated with the alert based on the assigned score; and 
if in response to the alert value is being below a threshold value, automatically closing 
the alert. 

71 . (Currently Amended) A computer program embodied on a computer readable medium 
for identifying a situation representing risk to a brokerage or its investors, wherein the program 
comprises one or more sequences of instructions that cause one or more processors to perform 
the steps of: 

receiving data from at least one source, wherein the received data comprises a plurality of 
transactions relating to securities trading and a plurality of entities involved in securities trading, 
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wherein the plurality of transactions and the plurality of entities are not predetermined to be 
related; 

accessing a scenario library to identify a detection algorithm for identifying a behavior of 
interest indicative of a risk to a brokerage or its investors; 

applying the detection algorithm to identify common elements between a plurality of the 
transactions and a plurality of the entities in the received data to determine whether the common 
elements are collectively indicative of the behavior of interest; 

determining whether one or more relationships exist among the transactions and the 
entities that exhibit the common element; and 

tf-ser in response to one or more relationships existing among the transactions and the 
entities that exhibit the common element, generating an alert informing a user of the related 
transactions and entities that exhibit the common elements. 

72. (Previously Presented) The computer program of claim 71 , wherein the 
instructions further cause the one or more processors to perform one or more of the following on 
the plurality of transactions and the plurality of entities: 

sequence matching to identify sequences in one or more transactions and to relate the 
identified sequences to one or more of the entities in the received data; 

link analysis to establish connections between one or more transactions and entities in the 
received data; 

rule-based analysis to identify at least one of the transactions and entities based on rules 
specifying parameters and thresholds; 
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outlier detection analysis to identity at least one of the transactions and entities outside of 
a defined statistical range; 

decision tree analysis; and 

detection processing using neural networks. 

73. (New) The method of claim 42, wherein applying the detection algorithm to identify 
common elements comprises determining whether the common elements are collectively 
indicative of a behavior that conflicts with one or more Securities Exchange Commission 
regulations. 

74. (New) The method of claim 42, wherein applying the detection algorithm to identify 
common elements comprises determining whether the common elements are collectively 
indicative of a behavior that conflicts with one or more National Association of Securities 
Dealers regulations. 

75. (New) The method of claim 42, wherein applying the detection algorithm to identify 
common elements comprises determining whether the common elements are collectively 
indicative of an illegal financial activity. 

76. (New) The method of claim 42, wherein applying the detection algorithm to identify 
common elements comprises determining whether the common elements are collectively 
indicative of a fraudulent financial activity. 
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77. (New) The method of claim 42, wherein: accessing a scenario library to identify a 
detection algorithm for identifying a behavior of interest indicative of a risk to a brokerage or its 
investors comprises identifying rapid switching of a first mutual fund for a second mutual fund, 
wherein one or more of the plurality of transactions is a solicited transaction involving one or 
more customers of a securities brokerage and one or more securities representatives, wherein the 
solicited transaction is solicited by the securities representative, wherein proceeds associated 
with the switching are at least a percentage of a value of the first mutual fund. 

78. (New) The method of claim 42, wherein: 
the behavior of interest comprises: 

selling, by a customer of a securities brokerage, a first mutual fund within six 
months of purchasing the first mutual fund, and 

using proceeds from the selling to buy a second mutual fund; and 
one or more of the following is solicited by a securities representative: 

sale of the first mutual fund, and 

purchase of the second mutual fund. 

79. (New) The method of claim 42, wherein generating an alert comprises generating an alert 
in response to the following: 

selling, by a customer of a securities brokerage, a first mutual fund wherein proceeds 
from selling are used to purchase a second mutual fund, wherein one or more of the selling and 
the purchase are solicited by a securities representative; 

proceeds from selling the first mutual fund are at least $10,000; 
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a purchase price of the second mutual fund is at least $10,000; and 
the proceeds from selling the first mutual fund are at least a percentage of a value of the 
first mutual fund. 
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